chore(deps): clear Dependabot security alerts

[JohnMcLear]

Clears all open Dependabot security alerts on this repo. Both are development-scope transitive dependencies coming in through pnpm-lock.yaml, not from any direct dependency, so the fix is a pnpm.overrides entry plus a regenerated lockfile.

alert	severity	package	scope	was	now
#47	high	js-yaml	development	4.1.1	4.3.2
#46	high	js-yaml	development	4.1.1	4.3.2
#39	high	brace-expansion	development	1.1.14	1.1.21
#38	high	js-yaml	development	4.1.1	4.3.2
#37	medium	js-yaml	development	4.1.1	4.3.2

5 alerts closed: 4 high, 1 medium.

Notes

• pnpm update --recursive --latest does not move either package, because neither is a direct dependency — hence the overrides.
• js-yaml is overridden to ^4.3.2 rather than >=4.3.2 so it stays on the 4.x line (js-yaml 5.x would break eslint 8).
• The brace-expansion override is scoped to the 1.x line (brace-expansion@1) so that minimatch 10's brace-expansion 5.0.12 resolution is left alone.
• Diff is limited to the lockfile plus the overrides block. No unrelated dependency bumps.
• pnpm run lint passes with 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Pin transitive dependencies to clear Dependabot alerts

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Pins vulnerable transitive development dependencies to patched, compatible release lines.
• Preserves brace-expansion 5 for minimatch 10 through a scoped override.
• Clears five Dependabot alerts without changing direct dependencies.

Diagram

graph TD
  P["package.json"] -->|declares overrides| R(["pnpm resolver"]) -->|records resolutions| L["pnpm-lock.yaml"]
  R -->|pins 4.x| J["js-yaml 4.3.2"]
  M3["minimatch 3"] -->|uses patched 1.x| B["brace-expansion 1.1.21"]
  R -->|scopes 1.x| B
  M10["minimatch 10"] -->|remains unchanged| B5["brace-expansion 5.0.12"]

Loading

High-Level Assessment

Targeted pnpm overrides are appropriate because the vulnerable packages are transitive and cannot be advanced through direct dependency updates. Constraining js-yaml to 4.x preserves ESLint 8 compatibility, while scoping brace-expansion to 1.x avoids altering minimatch 10's independent 5.x resolution.

Files changed (2) +16 / -14

Other (2) +16 / -14

package.jsonAdd scoped pnpm security overrides +6/-0

Add scoped pnpm security overrides

• Adds pnpm overrides that constrain js-yaml to patched 4.x releases and brace-expansion 1.x to patched releases. The brace-expansion selector prevents the override from affecting consumers of version 5.

package.json

pnpm-lock.yamlRegenerate patched transitive dependency resolutions +10/-14

Regenerate patched transitive dependency resolutions

• Records the new overrides and replaces js-yaml 4.1.1 with 4.3.2 and brace-expansion 1.1.14 with 1.1.21 throughout affected snapshots. The existing brace-expansion 5.0.12 resolution remains unchanged.

pnpm-lock.yaml